CVE-2026-120228
Critical · 9.9CVSS
9.9
EPSS
1.7%
Published
Nov 1, 2026
CISA due date
—
The record
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-95727 A command injection vulnerability exists in HPE Networking VIA. CWE-77
- CVE-2026-105982 Improper input validation in the IPsec VPN function may allow a remote attacker with high… CWE-77
- CVE-2026-105980 Improper input validation in the WireGuard VPN function may allow a remote attacker with… CWE-77
- CVE-2026-105979 Improper input validation in the ZeroTier VPN function may allow a remote attacker with… CWE-77
- CVE-2026-120345 A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120344 A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120282 A vulnerability was determined in WAVLINK WN536AX6-A V260507. CWE-77
- CVE-2026-120279 A flaw has been found in WAVLINK WN536AX6-A V260507. CWE-77